Ill Bloom Wallet-Drain Wave Steals More Than $2.5 Million in Bitcoin
A coordinated May 27 wallet-drain wave swept 431 accounts in a later reconstructed vulnerable-address set, stealing at least $3.14 million across several chains. Bitcoin accounted for about $2.57 million of the measured loss, including one Bitcoin account worth more than $1.1 million.
On May 27, 2026, a coordinated wallet-drain wave swept hundreds of cryptocurrency accounts that were later linked to weak recovery-phrase generation. Subsequent on-chain reconstruction by the Ill Bloom research project identified 431 drained accounts in a defined exposed-address set and measured approximately $3.14 million in losses from the event.
Bitcoin dominated the measured loss. Investigators attributed about $2.57 million of the first-wave theft to Bitcoin, compared with smaller amounts on Ethereum, Rootstock, Tron and Polygon. One Bitcoin account alone accounted for more than $1.1 million. The synchronized pattern—many unrelated accounts emptying during the same period and converging on a small number of destinations—distinguished the event from ordinary wallet activity.
The cause was not understood publicly on May 27. Later research connected the exposed wallets to weak recovery phrases generated through insecure randomness in CryptoJS-based wallet software, ultimately tracked as CVE-2026-71851. Investigators identified multiple affected wallet applications and continued to discover additional exposed addresses and later drain waves. Those findings are retrospective context; the event preserved here is the first confirmed coordinated theft observed on-chain on May 27.
The episode matters to Bitcoin because the majority of the first measured loss was bitcoin and because it demonstrated the long-lived danger of poor entropy at wallet creation. A recovery phrase can look valid and operate normally for years while containing far less randomness than users assume. The May drain turned that abstract implementation risk into a large, measurable Bitcoin theft and opened a wider investigation into wallet-generation security.